Note: I want to thank Will Gragido for stopping by this morning to talk over the news with us. Always great to have someone with a fresh perspective, I hope you enjoy the show.

Topics Covered

• Don't like Google Glass (or similar devices) on your network? Kick them off - http://mashable.com/2014/06/04/glassholes-wifi-jamming/
• The FAA has issued an order for Boeing to 'protect the planes from computer hackers' ... but what is really going on here? - http://www.usatoday.com/story/news/nation/2014/06/06/faa-boeing-737/10066247/
• APT, APT, APT, APT ... evolved APT? - http://www.csoonline.com/article/2158775/security-leadership/why-you-need-to-embrace-the-evolution-of-apt.html
• After getting breached, PF Chang's goes "old school"; sounds legit, right? - http://krebsonsecurity.com/2014/06/p-f-changs-confirms-credit-card-breach/
• Why preparation is a good idea, even when it comes to 'cyber' - http://www.csoonline.com/article/2360748/security-leadership/using-a-cyber-war-exercise-to-improve-your-security-program.html
• Feed.ly gets DDoS'd, extorted and we're mad as hell - http://www.forbes.com/sites/jaymcgregor/2014/06/12/feedly-goes-down-again-in-second-ddos-attack/
• Target hires a (good) CISO, Brad Maiorino, so why are people getting all bent out of shape over where he reports in the organization? - http://blog.wh1t3rabbit.net/2014/06/getting-wrapped-around-ciso-reporting.html

My apologies for some of the skips in this episode - we had some difficulty with the recording and ultimately I hope it doesn't take away from Joe's wonderful message.

Thanks for your patience.

In this episode

• From CISO to CIO - making that leap
• Does the CISO need to be technical? (answering that question, again)
• What types of things does a CIO need to know?
• Who should the CISO report to?
• Any chance the CISO reporting structure shifts around?
• A "Chief Data Officer"?
• Are there too many 'splintered' job titles in the security/risk role?
• Responsibility, accountability, and where the buck stops
• What are 3 things security does right, and what are 3 things that we do terribly?
• How big should your security budget be? (trick question)
• What KPIs should security be reporting to the CIO? (the hardest question ever)
• What resources are there for CIOs?

Guest

• Joe Riesberg ( @JoeRiesberg ) - Joe is currently the CIO of Drake University. Previos to his current role, he was the Senior Vice President, Global IT Security Services Director at Aviva plc. His LinkedIn profile can be found here: https://www.linkedin.com/pub/joe-riesberg/1/a81/931

Note: Today, Kim Halavakoski joined us on the show to provide perspective all the way from Finland! We appreciate his international addition to the show, and hope the listeners enjoy the added brainpower.

Topics covered

• Facebook's next major update will turn your mobile device into an always-on listening tool for FaceBook. This is a good time to remind you that you are the product, not the customer - http://www.ibtimes.com/facebook-microphone-update-store-data-social-media-giant-confirms-new-feature-will-1588916
• In a blow to security professionals' ego everywhere, investors apparently aren't swayed by data breaches - http://www.businessweek.com/articles/2014-05-23/why-investors-just-dont-care-about-data-breaches
• The US's indictment of 5 Chinese nationals for 'state sponsored industrial espionage' is apparently backfiring (or at least it is in the media) - http://www.bloomberg.com/news/2014-05-27/china-said-to-push-banks-to-remove-ibm-servers-in-spy-dispute.html
• Now that there is a hack to enable WinXP SP3 computers to masquerade as Point-of-Sale terminals and receiving updates ...should you even consider this? Hint: NO - http://blog.wh1t3rabbit.net/2014/05/hacking-registry-to-keep-windowsxp.html
• Target's Audit Committee is under fire for the data breach, but who's really, really at fault? An interesting perspective from Forrester - http://blogs.forrester.com/renee_murphy/14-05-29-dont_blame_targets_audit_committee_for_the_sins_of_technology_management

In this episode

• Jeff explains the background of the relationship between the US government, ICANN and IANA
• What is the ITU and why is this $0 contract handoff to the ITU such a big deal?
• What impact did Edward Snowden's actions have on the issue?
• The potential issues with DNS, cross-border censorship and DNS
• The importance of Tor, Freenet and challenges of implementation
• Discussing the evolution of services like Tor through "nation-state firewalls"
• Changing the image of anonymous services
• Making Tor and similar services more user-friendly, and more prevalent

Guest:

• Jeff Moss ( @TheDarkTangent ) - Jeff, also known as The Dark Tangent, is an American hacker, computer security expert and internet security expert who founded the Black Hat and DEF CON computer Hacker conferences. His Wikipedia page can be found here.

Announcements:

• I want to thank Circle City Con as a sponsor for the show! I have one more ticket to give away ... so watch the #DtR hashtag on Twitter!
• Thanks to special guest Philip Beyer for sitting in James' seat this morning...

Topics discussed

• "US charges China with cyber-spying on American firms" (Hello, pot? this is the kettle...) - http://www.nbcnews.com/news/us-news/u-s-charges-china-cyber-spying-american-firms-n108706
• Should we be thinking about security beyond win/lose (aka "oh no, hackers are winning!") - http://www.csoonline.com/article/2156104/security-leadership/thinking-about-security-beyond-winning-and-losing.html
• Retail Industry Leaders Association (RILA) has launched their own ISAC-like entity called Retail Cyber Intelligence Sharing Center (R-CISC) - http://associationsnow.com/2014/05/retail-group-launches-sharing-tool-cyber-threats/
• A recent survey tells us that a whopping 43% of all identity theft in 2013 happened in healthcare ( W O W ) - http://www.studentdoctor.net/2014/04/the-rise-of-medical-identity-theft-in-healthcare/
• Self-driving cars, making life-and-death decisions (this should terrify you) - http://www.wired.com/2014/05/the-robot-car-of-tomorrow-might-just-be-programmed-to-hit-you/

In this episode

• Dan gives us the reality of living in what is commonly termed "the post-breach" world
• Dan and Robin talk through the explosion in the numbers of malware samples
• We discuss the different approaches to malware, crimeware, and the cross-over between them
• Dan explains what "rapid incident response" really means and why it's essential
• Dan and Robin give us some excellent examples of incident preparedness fundamentals
• Dan gives us a lesson on implementing 'powerful tools' (and forgetting about them)
• We talk through "who's doing it well?" (and we don't get a very hopeful answer)
• Is it time to learn from our own and others mistakes? (how?)

Guests:

• Robin Jackson ( @rjacksix ) - Robin is an incident response and digital forensics specialist for HP Enterprise Security Services.
• Dan Moore - Dan is an incident response and digital forensics specialist for HP Enterprise Security Services.

Topics dicussed

• Microsoft has issued a patch for the massive MS IE flaw - for WindowsXP! - http://arstechnica.com/security/2014/05/microsofts-decision-to-patch-windows-xp-is-a-mistake/
• Is Open Source Software more or less secure than closed-source? (in a post-Heartbleed era) - http://www.telegraph.co.uk/technology/internet-security/10769996/Heartbleed-the-beginning-of-the-end-for-open-source.html
• Target's CEO has stepped down, but what's the real reason and is there now opportunity for change? - http://www.usatoday.com/story/money/business/2014/05/05/target-ceo-steps-down/8713847/ and http://www.latimes.com/business/money/la-fi-mo-target-ceo-resigns-20140505,0,4479532.story
• Biometrics (specifically fingerprints) aren't as secure or unique as we'd like them to be, so ... paswords? - http://www.telegraph.co.uk/science/science-news/10775477/Why-your-fingerprints-may-not-be-unique.html

In this episode

• We discuss some of the new techniques auto insurance companies are using to custom-tailor rates to drivers
• Our guest discusses some of the capabilities of the widgets available
• Our guest discusses the 'call home' functions, and potential mis-use
• We use 'big data' seriously
• We talk about 'big data' and security - for real
• Our guest gives us a realistic view about the type of data that's out there about your driving, habits, and tracking

Guest

• Our guest is an industry insider, who for obvious reasons chose not to identify himself. We respect the guest's position, and kindly ask that our listeners do as well.

Hey listeners!

Thanks to everyone who's put us in their RSS feed and regularly grabs the latest content. I just ran a running average of the last 20 episodes, and as of right now we're averaging ~802 downloads/episode. That's awesome, and so much more than I ever thought this show would grow to! It's all thanks to you, for listening, spreading the word, and being fans.

As we near episode 100 I promise you an episode you'll want to listen to, and share with those you know. James and I are working hard to make it special, with a guest that's ... well ... you'll see.

Thanks for being a fan.

/Raf & James

Topics discussed

• The big story - "Heartbleed"
  • http://www.csoonline.com/article/2142626/security-leadership/how-you-need-to-respond-to-heartbleed-and-how-you-can-explain-it-to-others.html
  • http://www.csoonline.com/article/2146141/disaster-recovery/healthcare-gov-urges-password-resets-due-to-heartbleed.html
  • http://xkcd.com/1354/
  • http://rt.com/news/heartbleed-arrest-canada-security-016/
• The "hacker*" known as "Weev" is free ...on a technicality, and why this is bad, very very bad, for our industry
  • http://techcrunch.com/2014/04/11/weev-is-free/
• "Ramshackle Glam" - how one blogger had to go to extraordinary lengths to get her site back, and what you can learn from it
  • http://mashable.com/2014/04/02/ramshackle-glam-hacking/
• The FTP's lawsuit of Wyndham Hotels was allowed to proceed by a federal judge - and why this is a very dangerous precedent
  • http://www.fiercegovernmentit.com/story/ftc-lawsuit-over-hotel-chain-data-breach-can-proceed/2014-04-14
• Data breach roundup
  • Michaels [yes, again] - http://www.business-standard.com/article/news-ani/leading-us-art-store-admits-2-6-mln-credit-cards-at-risk-of-hacking-114041800569_1.html
  • South Carolina data breach is getting costly (for tax payers) - http://www.therepublic.com/view/story/396a4be862cd485e9248cab7879a3a71/SC--Hacked-Tax-Returns
  • Hard drive maker LaCie was a victim ...for over a year - http://www.techtimes.com/articles/5672/20140416/lacie-latest-victim-data-theft-ironies-hard-drive-manufacturer-hacked.htm
  • [UK] Cosmetic surgery group hacked, blackmail ensues (yikes!) - http://www.dailymail.co.uk/news/article-2604805/Cosmetic-surgeons-targeted-hackers-personal-details-500-000-people-enquiries-clinic-stolen.html
  • Pittsburgh's UPMC hacked, sees 788 fraudulent tax returns as a result - http://www.witf.org/news/2014/04/27k-upmc-worker-hit-by-data-breach-788-by-fraud.php

In this episode

• Advanced Threat Actors - more or less a threat right now than before? (how much is hype?)
• Advanced Persistent Threat - is it really THAT advanced? (a "what" or a "who"?)
• The distinction of what "APT" is ...and isn't
• Touching on Mandiant APT-1 ...hype from reality
• A quick discourse on corporate espionage!
• How we respond to APTs ... is this just really "incident response" for a boogeyman?
• The snake oil salesman behind "Automated APT defense"
• Threat Intelligence - necessary, but what's the proper use?
• Threat Intelligence requires collaboration, how do we do it?
• Is our security failing, or is our perception of what we want it to do wrong?
• Key take-aways for the enterprise professional

Guests

• Steve Santorelli ( @SteveSantorelli ) - Manager of outreach at Team Cymru
• John Pirc ( @jopirc ) - CTO of NSS Labs
• J. Oquendo ( @advancedthreat ) - veteran threat researcher
• Robin Jackson ( @rjacksix ) - veteran threat researcher, forensics expert at HP Enterprise Security Services

Topics covered

• WindowsXP is officially, for real, definitely end of life - http://windows.microsoft.com/en-us/windows/end-support-help
• Google Nest pushes update - examining the bigger picture - http://www.theregister.co.uk/2014/04/04/nest_waves_goodbye_to_alarm_switchoff_feature/
• South Carolina's agencies are still not any better after the massive breaches - http://www.wbtw.com/story/25149085/still-no-consistent-computer-security-plan-at-sc-agencies
• News flash - we trust the government and Internet companies less as a result of leaks - http://www.computerworld.com/s/article/9247441/Snowden_leaks_erode_trust_in_Internet_companies_government
• The two banks which filed suit against TrustWave & Target have dropped their effort...sanity apparently prevailed but there's a bigger issue here at stake - http://www.securityweek.com/banks-drop-suit-against-target-trustwave

In this episode

• Rise of DDoS
  • Where did it come from
  • What's next
  • Why does it work
  • Spoofer project
  • 3-DOS attacks
• Quantum computing
  • What is it
  • How is it different than what we commonly use today
  • What problems does it solve
  • How practical is it
• The dark web
  • Where did it come from
  • Legitimate uses, turn into nefarious use-cases
  • Alternatives, adoption and options

Guest

• Prof. Alan Woodward ( @ProfWoodward ) - Alan is not only a subject matter expert in computing, computer security and the impact technology has on business but brings to his roles a very broad range of experience in business management, technical management and project management.
  Whilst he has particular expertise in covert communications, forensic computing and image/signal processing, Alan is primarily a particularly good communicator, be it with clients, staff or investors. He is known for his ability to communicate complex ideas in a simple, yet passionate manner. He not only publishes in the academic and trade journals but has articles in the national press and appears on TV and radio. Despite the length of his experience, his hands-on ability with emerging technologies contributes significantly to the respect he is repeatedly shown when he leads teams where technology is involved.
  Alan has been involved in some of the most significant advances in computer technology and, although he continues to work in industry, he is actively involved with academia as a visiting Professor in the Department of Computing which is part of the Faculty of Engineering and Physical Sciences at the University of Surrey.
  His achievements have resulted in him rising to become a Fellow of various institutions including British Computer Society, Institute of Physics and Royal Statistical Society.

Did you catch all that? DtR is giving away a free ticket to Source Boston - if you're interested in being the lucky recipient - be the first to @Wh1t3Rabbit with "I just won a ticket to @SOURCEConf Boston courtesy of the #DtR Podcast!"

Topics covered

• The FTC jumps into the breech (pun intended) and may try and levy fines against Target, and future breach victims - http://ww2.cfo.com/technology/2014/03/ftc-urges-data-breach-penalties/ http://www.nextgov.com/cybersecurity/2014/03/target-could-face-federal-charges-failing-protect-customer-data-hackers/80824/?oref=ng-channelriver
• Could the Barclays Bank breach of Feb 2014 have been <drumroll> test data? Richard Bishop thinks so - http://blog.trustiv.co.uk/2014/03/barclays-data-breach-%E2%80%93-could-it-be-test-data http://www.theregister.co.uk/2014/02/10/barclays_investigates_gold_mine_client_data_breach/
• US Commerce Dept not renewing ICANN contract, moving control to ITU - http://www.bloomberg.com/news/2014-03-15/u-s-to-relinquish-control-of-internet-address-system.html http://www.businessweek.com/articles/2014-03-17/the-u-dot-s-dot-ends-control-of-icann-gives-up-backing-of-the-free-speech-internet
• With Microsoft officially, and finally, stopping support for WinXP (after 14yrs!), is there a "breach crisis" around the bend? - http://www.pcmag.com/article2/0,2817,2455206,00.asp
• Microsoft can read your Hotmail/webmail ...so can Google, Apple and Yahoo! hype or crisis? - http://www.theverge.com/2014/3/21/5533814/google-yahoo-apple-all-share-microsofts-troubling-email-privacy-policy
• (bonus) "eGovernment" is something many governments globally and locally are moving ahead with - is this rainbows or rain clouds? I joined Discover Performance Weekly to briefly discuss - http://youtu.be/bAfP-jc0x6Q

In this episode

• what is the promise of automation, and where did we go wrong (or right?)
• the problems with 'volume' (of logging) and the loss of expressiveness
• a dive into 'exploratory based monitoring'
• how does log-based data analysis scale?
• baselines, and why 'anomaly detection' has failed us
• does machine learning solve the 'hands on keyboard' (continuous tuning) problem with SIEM?
• does today's 'threat intelligence' provide value, and is it really useful?
• decrying the tools - and blaming the victims
• what is machine learning good at, and what won't it be great at?
• log everything!

Guest

• Alex Pinto ( @alexcpsec ) - Alex has almost 15 years dedicated to Information Security solutions architecture, strategic advisory and security monitoring. He has been a speaker at major conferences such as BlackHat USA, DefCon, BSides Las Vegas and BayThreat.
  He has been researching and exploring the applications of machine learning and predictive analytics into information security data sources, such as logs and threat intelligence feeds.
  He launched MLSec Project (https://www.mlsecproject.org) in 2013 to develop and provide practical implementations of machine learning algorithms to support the information security monitoring practice. The goal is to use algoritmic automation to fight the challenges that we currently face in trying to make sense of day-to-day usage of SIEM solutions.